Loading story…
Researchers reported that the AngrySpark Windows backdoor, previously observed on a single UK victim, used a highly engineered three-stage architecture built around a custom virtual machine running inside svchost.exe. The malware employed a masquerading DLL loader, a VM-based shellcode loader, and a beacon that profiled the host, fetched encrypted payloads from command-and-control servers, and hid HTTPS traffic as PNG image requests. Analysis of memory snapshots from 2022 through early 2023 showed the implant was actively maintained before development appeared to stop, and the operation faded as its infrastructure lapsed, with blocked C2 connectivity, expired domains, and expired certificates effectively ending the malware’s activity.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-27, Bill Marczak published an analysis arguing that AngrySpark infrastructure overlaps with the previously tracked SCALENE cluster and discussing possible relationships to OBTUSE and Operation Triangulation. The article stopped short of definitive attribution but presented the overlap as a significant clue about the spyware's pedigree.
A later analysis reported that a server previously tracked as part of the SCALENE cluster was confirmed by Gen in April 2026 as an AngrySpark command-and-control server. This connected SCALENE to real spyware activity and suggested infrastructure overlap with other suspected spyware clusters.
On 2026-04-14, Gen Digital published research detailing the AngrySpark malware, its architecture, and its observed operational timeline. The report described the malware as highly sophisticated but seen on only one host.
By June 2023, the DLL certificate associated with AngrySpark had expired, effectively contributing to the malware's disappearance. Gen Digital described this as part of the operation's end state.
By May 2023, the beacon domain used by AngrySpark had expired. This further degraded the malware's ability to operate.
By April 2023, the malware's command-and-control connection was blocked. Gen Digital cited this as part of the infrastructure's decline and the malware's disappearance.
Analysis of a January 2023 memory snapshot suggested AngrySpark's code had frozen by then, with only configuration changes continuing afterward. This marked a shift from earlier active maintenance.
A June 2022 memory snapshot indicated the malware was still being actively maintained in mid-2022. Gen Digital said analysis showed active maintenance during this period.
One of the analyzed memory snapshots from May 2022 showed AngrySpark active on the victim host. Gen Digital used this snapshot as part of its reconstruction of the malware's development and operation.
Gen Digital reported discovering the AngrySpark backdoor on a single victim machine in the United Kingdom in spring 2022. The malware used a modular three-stage architecture including a DLL loader, a VM-based shellcode loader, and a beacon payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcegendigital.com
Open sourcedatatracker.ietf.org
Open sourcedatatracker.ietf.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that the open-source **Sliver** command-and-control framework has been repeatedly used in real-world malicious operations, expanding beyond red-team use into opportunistic exploitation and targeted intrusions. Team Cymru documented Sliver activity tied to scanning and likely exploitation of internet-facing systems vulnerable to **Log4j**, **ProxyShell**, and **VMware Horizon**, with some infections appearing to progress to deployment of **Atera** or possible **Virlock** ransomware monetization. The same research also linked Sliver infrastructure and spoofed government-themed domains to activity targeting organizations in Pakistan and Turkey, with telemetry suggesting overlap with **Cobalt Strike** on related infrastructure. Separate analysis from AhnLab described a supply-chain-style campaign in South Korea in which trojanized installers posing as VPN and marketing software delivered malware that injected **Sliver** into `notepad.exe`, then installed **MeshAgent** for persistence and, in some cases, a webcam-capture tool. Research presented by IIJ and JPCERT/CC further showed that Sliver is one of several publicly available post-exploitation frameworks now commonly abused by attackers, and highlighted detectable artifacts including its default process injection into `notepad.exe`, along with execution and persistence traces in Windows event logs. Together, the reports show Sliver has become a mainstream attacker tool for initial access, remote control, persistence, and follow-on payload delivery.
Aug 15, 2026
Multiple phishing campaigns delivered **SnakeKeylogger**, **VIPKeylogger**, and **Agent Tesla** through layered infection chains that used obfuscated VBScript or PowerShell droppers, steganographic payload staging on Cloudinary, Internet Archive abuse, reflective in-memory .NET loading, and process hollowing into legitimate Windows binaries such as `Caspol.exe`, `Aspnet_compiler.exe`, and `RegAsm.exe`. One DHL-themed operation used a VIPKeylogger variant identified as a SnakeKeylogger rebrand, while a separate GuLoader campaign targeted Italian businesses with NSIS-wrapped stealers and business email compromise-style lures. Across the campaigns, the malware stole browser passwords, email and FTP credentials, Outlook and WinSCP secrets, Discord tokens, Wi-Fi passwords, screenshots, clipboard data, and keystrokes, then exfiltrated data over **SMTP**, **Telegram**, and **FTP**. Investigators found repeated operator OPSEC failures that exposed active criminal infrastructure and victim data. A VIPKeylogger/SnakeKeylogger operator left a stock **XAMPP** dashboard and internet-accessible **WinRM** open on `144.172.105.88`, while sandboxing captured plaintext SMTP credentials tied to `result@miniorangeman.com` on `185.196.9.150`; although that C2 was taken offline shortly after detection, the Cloudinary-hosted payload and SMTP infrastructure reportedly remained live. In a separate GuLoader operation, an open FTP directory on `holzbrenzii[.]com` exposed **52 credential dumps from 27 victim machines** in real time. Another SnakeKeylogger v4.4 campaign linked distinct droppers to the same backend through shared C2 strings, DDNS infrastructure, and staging artifacts, showing that technically capable malware operators repeatedly undermined their own campaigns by exposing panels, credentials, and stolen data.
Jun 29, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026